PROPOSING A MECHANISM FOR REMOVING TRADE SECRETS FROM THE INTERNET

12 No. 3 J. Internet L. 3 (September, 2008)

Elizabeth A. Rowe

Late on a Friday afternoon in October, Wal-Mart executives discover that the content of their sales circulars for the entire Christmas season has just been posted on fatwallet.com, a bargain-shoppers discussion forum. The posted content includes Wal-Mart's closely guarded sale prices. Fearing that competitors may use the valuable pricing information to compete unfairly, Wal-Mart's attorneys immediately contact the operators of the Web site to request that they remove Wal-Mart's trade secret information.

The operators refuse. They contend, correctly, that since the information is not copyrighted they have no obligation to remove it under the Digital Millennium Copyright Act (DMCA), which does not cover trade secrets. The information remains posted throughout the weekend and for another four days until Wal-Mart obtains a temporary restraining order from the court to have the material removed. By then, however, overjoyed shoppers have distributed the circulars all over the Internet, and using this information, Wal-Mart's competitors are modifying their planned promotions. [FN1]
This article explores, for the first time, an existing void in trade secret law. When a trade secret owner discovers that its trade secrets have been posted on the Internet, there is currently no legislative mechanism by which the owner can request that the information be taken down. The only remedy to effectuate removal of the material is to obtain a court order, usually either a temporary restraining order or a preliminary injunction. When a trade secret appears on the Internet, the owner often loses the ability to continue to claim it as a trade secret and to prevent others from using it. Accordingly, trade secret owners bear the burden of being vigilant and acting quickly if there is to be any chance of preserving the trade secret status of the information. The current requirement of a court order for a takedown is not only costly but also too slow for trade secret owners because of the speed with which users distribute information over the Internet. Obtaining a temporary order from a court would likely take no fewer than several days.

Given that secrecy is vital to preserving trade secret status, time is of the essence to trade secret owners, and each hour that a trade secret is available on the Internet is an hour too long. In order to address this time-lapse problem, this article explores a proposal for trade secret takedown legislation similar to that which provides for the immediate removal of suspected copyright violations under the DMCA. A takedown provision for trade secrets would provide self-regulation and privatized enforcement in an effort to permit trade secret owners to save their trade secrets from near-certain death on the Internet. A takedown provision would offer an expedited process for disabling access to trade secret information in the interim period between discovery of the misappropriated material and issuance of a ruling by a court.

The Internet's rise has spawned a motivation to acquire trade secrets for a reason other than competitive advantage--employee revenge. The ease with which virtually anyone can post information on the Internet, coupled with the Internet's "disinhibiting effect" [FN2] and a general decline in employee loyalty, [FN3] has allowed disgruntled employees to achieve the ultimate revenge against their former employers by destroying trade secrets. One court noted the shift in the balance of power made possible by the Internet: "With the Internet, significant leverage is gained by the gadfly, who has no editor looking over his shoulder and no professional ethics to constrain him. Technology blurs the traditional identities of David and Goliath." [FN4] Accordingly, Internet disclosures are likely to become a greater problem than they have been in the past. Trade secret owners also hesitate to file suits because they fear that such lawsuits will incite even-greater discussion or even disclosure of their trade secrets online. One trade secret owner resorted to filing suit as an anonymous plaintiff in order to avoid further economic harm from the publicity, but the court ultimately prohibited the owner from proceeding anonymously. [FN5]
*4 Despite the apparent need for this kind of legislative mechanism, Congress should tread cautiously to maintain an appropriate balance between protection for trade-secret owners, on the one hand, and the public's right to free expression and the use of information in the public domain, on the other hand. Ultimately, the objective should be for policy makers to create legislation that a trade secret owner can use as a shield to protect its intellectual property rather than as a sword to suppress publication of embarrassing content. It is also important that Congress tailor any legislation to fit existing trade secret law principles in order to ensure consistency in implementation and application by courts. The legislation proposed in this article keeps these objectives in mind.
The article begins by providing relevant background about the law pertaining to trade secrets on the Internet. It then explains why a takedown provision for trade secret law merits consideration. The next part summarizes briefly the DMCA safe harbor provision. The article then introduces components of the proposed trade secret takedown legislation and highlights potential areas of concern, such as the First Amendment and technological challenges. Finally, it concludes by arguing that, in light of the various considerations explored in the article, Congress should consider takedown legislation for trade secrets using the DMCA Safe Harbor Provision as a starting point.

BACKGROUND: TRADE SECRETS ON THE INTERNET

Trade secret law protects only secret information. [FN6] The Internet makes information publicly available. Naturally, these opposing functions set the stage for conflict. Thus, many courts assume that a trade secret posted on the Internet has become generally known and consequently has lost its trade secret status. [FN7] Even when a party posting trade secret information may not have intended to cause harm to the trade secret owner, the nature of the Internet is such that the posting could still destroy the secret. [FN8] Unlike other mass media, the Internet has no editors who scrutinize submissions and decide what materials to publish. Any person sitting at a computer can post information on the Internet, and the posting can result in immediate and irreparable harm. One judge described the problem:
The court is troubled by the notion that any Internet user ... can destroy valuable intellectual property rights by posting them over the Internet, especially given the fact that there is little opportunity to screen postings before they are made. Nonetheless, one of the Internet's virtues, that it gives even the poorest individuals the power to publish to millions of readers, can also be a detriment to the value of intellectual property rights. The anonymous (or judgment proof) defendant can permanently destroy valuable trade secrets, leaving no one to hold liable for the misappropriation. [FN9]
To make matters worse, the trade-secret owner may never know the identity of the person making the disclosure, and the person posting the information may very well be far removed from the person who originally misappropriated the secret.
Under very limited circumstances a trade secret owner might be able to save its trade secret from the near-certain death sentence imposed by the Internet. [FN10] Critical to this preservation effort, however, is how long the trade secret is exposed and how quickly its owner acts to prevent further dissemination of the trade secret. The rate at which information spreads across the Internet dictates that a trade secret owner's actions should be correspondingly rapid. Information that has been posted for more than one or two days is more likely to have become "generally known," and deemed to have lost its status as a trade secret, than information that has been posted for a shorter amount of time. [FN11]
Accordingly, a trade secret owner who discovers its trade-secret information on the Internet must respond immediately and show that it took prompt action to remove the information or stem its further dissemination. [FN12] In seeking to retain trade secret protection of information that has been posted, the goal is to separate trade secret owners who have "slept on their rights" upon discovering the potentially fatal disclosure from those who have responded promptly. Unfortunately, given the special concerns associated with trade-secret cases involving Internet postings, the tools currently in place for addressing removals from Web sites are not satisfactory. If trade secret owners are to bear the burden of acting swiftly to remove trade secrets from Web sites, then the legal system should provide appropriate, efficient, and effective mechanisms for trade-secret owners to do so.

A TAKEDOWN FOR TRADE SECRETS MERITS CONSIDERATION

A trade secret can be any information of value that is used in a business, has been kept secret, and provides an economic advantage over competitors. [FN13] The wide range of information entitled to trade secret protection includes costs, sales records, customer lists and information, marketing strategies, secret contract terms, unpublished pricing information, and chemical formulas. [FN14] Trade secrets *5 encompass approximately 80 percent of the assets of some companies. [FN15] In addition, prior to obtaining patent protection, virtually all inventions are covered by trade-secret protection. [FN16]
From an efficiency perspective, trade secrets deserve strong protection because of their importance to industry and the economy. Trade secrets are integral to the economy because they protect and encourage innovation. Publicly traded US companies own an estimated $5 trillion in trade-secret information. [FN17] Trade secrets are important to businesses of all sizes, from the smallest mom-and-pop shops to the largest multinational entities. Trade secrets are often the most valuable intangible assets of a company, and the survival of a company may depend on its ability to protect its trade secrets. In the Internet age, securing information can be especially daunting because once a trade secret has been disclosed, even if inadvertently, it ceases to be a trade secret. [FN18]
Part of the appeal of choosing trade secret protection over other kinds of intellectual property protection is the broad scope of protectable information and the relative ease with which a business can claim such protection. A business can, for example, protect trade secrets without complying with a governmental registration system. To the extent that part of copyright law's impetus for providing a safe-harbor takedown for Internet-service providers (ISPs) is meant to address any potential liability for copyright infringement, the same concerns also apply to trade secret law. [FN19] An ISP may be liable for trade secret misappropriation if the ISP knows or has reason to know that a subscriber is misappropriating a trade secret. [FN20] Arguably, the notice from the trade-secret owner would be sufficient to create the requisite level of knowledge. Accordingly, it makes sense to consider a similar framework for both trade secrets and copyrights because the underlying reasons for the legislation and the ultimate objectives are comparable.

BRIEF SUMMARY OF THE DMCA'S SAFE HARBOR PROVISION

In order for an ISP to qualify for the safe harbor under § 512 of the DMCA, the alleged infringement generally has to occur during one of four basic activities: (1) transitory digital-network communications, (2) system caching, (3) storing information at the direction of the user, or (4) providing an information-location tool. [FN21] Furthermore, to protect ISPs' good faith actions to help mitigate infringement, the provision provides that "[a]ny person who knowingly materially misrepresents ... (1) that material or activity is infringing, or (2) that material or activity was removed or disabled by mistake or misidentification" will be liable for any resulting damages, including costs and attorneys' fees, to the affected ISPs. [FN22] These limitations were designed to immunize ISPs from liability for contributory infringement and to provide "strong incentives" to foster cooperation between ISPs and copyright owners in the fight against copyright infringement on the Internet. [FN23]
Section 512(a) provides the broadest protection for ISPs that provide transmission and routing services and are thus mere conduits of information. [FN24] These providers--typically high-speed-Internet, broadband, and DSL providers--receive safe harbor from their users' infringement activities without any requirement that they take down allegedly infringing material. [FN25] The only condition of their safe harbor is that they adopt a policy for terminating repeat infringers and accommodate technical protection measures. [FN26]
Sections 512(c) and (d) apply to ISPs providing hosting services [FN27] and search engines. The takedown provision applies mainly to these providers. To receive the safe harbor from liability, these providers are required to remove allegedly infringing content upon receipt of notice from the copyright holder. [FN28] The § 512(c) process requires that the ISP (1) "expeditiously" take down the information, (2) notify the alleged infringer that the material has been removed, [FN29] and (3) forward any counter-notices from alleged infringers back to the original complainant. [FN30] If after 10 to 14 days the complainant does not notify the ISP that it has filed an action against the alleged infringer, then the ISP may put back the material. [FN31]
Much has been written about the DMCA takedown provision. [FN32] Many commentators believe that copyright holders have abused the takedown provision and that the provision could be improved by better balancing the benefits to copyright owners with the protections for posters of allegedly infringing material. [FN33] Despite the provision's weaknesses (perceived or actual), however, it has achieved the intended purposes that spurred the legislation: It clarifies ISP liability for contributory copyright infringement and promotes the distribution of copyrighted works over the Internet. [FN34] This article does not address changes to the DMCA's safe harbor provision. Rather, it simply uses the provision as a starting point from which to design a trade secret takedown provision that is carefully tailored to the principles of trade secret law while being mindful of the lessons learned from the DMCA.

SUMMARY OF THE TRADE SECRET TAKEDOWN MECHANISM

This article does not assume the intricate task of drafting trade secret takedown legislation. However, it is *6 mindful of existing trade secret law principles in suggesting solutions. It also offers several points for consideration by identifying some of the potentially thorny issues that may arise from trade secret regulation. The lessons learned from the implementation of § 512 of the DMCA are certainly helpful and provide guidance on the direction of the trade-secret endeavor. Those lessons, together with an understanding of the theory and practice of trade secret law, could be instructive if Congress were to create this legislation.
The form of a trade secret takedown provision could be an expansion of the DMCA, an expansion of the Economic Espionage Act, [FN35] or a creation of an original body of legislation. The actual process by which material would be removed could be very similar to that established under the DMCA, subject to some modification to accommodate the concerns raised below. In short, the complainant would provide notice of the alleged inappropriate posting of the trade secret to the ISP. Upon receipt of the notice, the ISP would need to remove the material within a very short time (probably within five hours). [FN36] The trade secret owner would then file a complaint in court within a certain number of days (probably 10 days) or provide proof to the ISP of an agreement with the alleged misappropriator. Failure to take this step would result in automatic return of the information to the Web site. A notice provision to alert the subscriber of the takedown could be required, but the nature of a counter-notice requirement is less clear.

DEALING WITH FRIVOLOUS REQUESTS

Because of the potential for misuse of a takedown for trade secrets, a complaining trade secret owner's takedown notice should be accompanied by a bond or fee. Under the DMCA, a complainant needs a subjective "good faith belief" of infringement to request a takedown. [FN37] Although a similar requirement makes sense for trade secrets, some additional assurance is probably necessary to counteract illegitimate uses of the mechanism. The required fee should be costly enough for large companies yet not so expensive that it would be prohibitive for small businesses. Perhaps something akin to the posting of a bond for the granting of preliminary injunctive relief could be a helpful model. [FN38] Alternatively, it could be a fee to the ISP as compensation for having to divert its resources to removing or disabling information within hours of receiving a takedown request.
In addition, there should be a statutory remedy for a frivolous takedown request. [FN39] An alleged infringer whose material is improperly subjected to a takedown under the DMCA has a remedy against the copyright owner if a knowing material misrepresentation was made in the notice to the ISP. [FN40] For example, in Online Policy Group v. Diebold, Inc., [FN41] a federal district court in California concluded as a matter of law that Diebold had "knowingly materially misrepresented" that publication of its email archive exposing weaknesses in its voting machines was protected by copyright law. This misrepresentation was material because the takedown notice caused the Web sites to remove their email archives. [FN42] Ironically, the contents of the emails might have been protectable under trade-secret law.
An analogous bad-faith-type standard seems appropriate for a trade secret takedown provision. While the standard may be difficult to meet depending on the particular circumstances of a case, it should not necessarily be any lower because the complexity and unpredictability of trade secret law would likely render any other standard too difficult for trade secret owners. Just as in Diebold, courts would expect that, if a trade secret owner submits a takedown notice for material that a court determines that the owner should have known was not protectable as a trade secret [FN43] (e.g., the owner had not taken adequate steps to protect the information), then liability under a "knowingly material misrepresentation" standard could be satisfied. Indeed, trade secret law provides support for penalizing a trade secret owner for asserting a trade secret claim in bad faith. Thus, an extension of this principle in this context would be entirely consistent. [FN44] It is also important because the nature of trade secret law is such that there is no prima facie certification of a trade secret that a trade secret owner can present or upon which an ISP can rely for verification.

CARVE OUT FOR MERE CONDUITS AND THE PRESS

ISPs that provide only transmission and routing services and are merely conduits of alleged trade secrets should be exempt from the takedown notice procedure for two reasons. [FN45] First, as a practical matter, because material resides on their users' computers rather than on the ISPs' servers, the ISPs have no ability to remove offending material from their systems. [FN46] Second, it is highly unlikely that the mere transmission of trade secret information under these circumstances would constitute actionable trade secret misappropriation. Accordingly, since liability would not be well grounded in trade secret law, it makes little sense to include these transmitters as part of the takedown scheme; in fact, doing so would impose unnecessary costs and burdens to comply. [FN47]
Because liability for trade secret misappropriation against publishers in established news organizations is *7 currently unsettled and, indeed, any consensus (to the extent one exists) points away from such liability, it may be advisable to exempt "established news organizations" [FN48] from the takedown statute. In particular, when members of such organizations played no part in illegally obtaining a trade secret that is a matter of public concern and lawfully accessed the trade secret; current Supreme Court jurisprudence appears to shield the press from liability for disclosure under the First Amendment. [FN49] To be clear, providing a carve out in this statute for the press does not provide immunity. Rather, where the trade secret appears on a Web site belonging to a covered news organization, a trade secret owner could not use the takedown statute to have the information removed. Instead, the currently existing process of filing suit and moving for a preliminary injunction would be required.
This carve out is further supported by other considerations that aim to make the provisions of the proposed legislation consistent with current principles of trade secret law. For instance, one practical effect of having the deliberative review of information by an editorial staff before it is posted or published is that it serves as a filter for the intent of the poster; Information that is newsworthy, rather than information which is posted mainly to exact revenge or to harm a trade secret owner, is more likely to be protected. [FN50] Furthermore, it would be consistent with the privilege in trade secret law to disclose trade secrets that are "relevant to public health or safety, or to the commission of a crime or tort, or to other matters of substantial public concern." [FN51] From a practical perspective, it would also mean that the Wall Street Journal or the New York Times would not need to take down news articles from their online editions that nonetheless appear in the print version of the newspaper.

SUBPOENA PROVISION

Similar to the DMCA, a provision permitting the trade secret owner to obtain a subpoena for the identity [FN52] of the alleged misappropriator might be of value. [FN53] Nonetheless, recognizing that this kind of provision could be fraught with hazards, a careful analysis--perhaps including an evaluation of the implementation of the DMCA's corollary provision--would be wise. For instance, the subpoena provision in § 512 does not appear to apply to ISPs who are mere conduits, that is, those who do not store material on their servers. [FN54] Whether it should remain the same for trade secrets and the implications flowing from any resulting position would be an important consideration.
The ability to subpoena the identity of an alleged misappropriator would permit a trade secret owner to pursue a misappropriation action against the individual posting the information, [FN55] as is required under this proposal. However, the provision must be carefully tailored to avoid abuses. [FN56] The DMCA subpoena provision empowers a court clerk, not a judge, to issue the subpoena. While the application for the subpoena must be accompanied by the takedown notice, additional safeguards should be required to help ensure, for instance, that (1) the subpoena is sought by a bona fide owner of a trade secret, (2) it is intended to be used for the exclusive purpose of enforcing trade-secret rights, and (3) the alleged misappropriator has notice and an opportunity to object to its issuance. [FN57] These considerations must nevertheless balance the inherent tensions between offering adequate protections to the subscriber and the trade-secret owner while also maintaining a speedy and efficient process.

STRICT COMPLIANCE REQUIRED

Given the fluid nature in which trade secrets are identified, as well as the drastic ex ante restraint that a takedown requirement imposes, it would appear that strict compliance with the notice provisions ought to be mandatory. Thus, a provider receiving an incomplete takedown notice may reject the notice for failure to comply with the statutory provisions. [FN58] One of the problems facing implementation of the DMCA's takedown provision has been the failure to comply with the strict notice requirements. [FN59] As a result, the question of whether an ISP can be protected by the liability limitations when the takedown notice has, for instance, failed to identify the allegedly infringing material with sufficient specificity has met with mixed results. [FN60]
Requiring compliance with the notice requirement is also consistent with trade secret law because in order to succeed on a misappropriation claim, a trade secret plaintiff must identify the alleged trade secret with particularity. [FN61] Moreover, given the inability to pre-certify a trade secret, a strict compliance requirement in the trade secret context seems reasonable. This measure would also help alleviate potential abuses by providing an additional incentive for those submitting a takedown notice to be especially cautious about following the notice requirements. In addition, it would eliminate any uncertainty for providers that receive incomplete notices and are unsure about whether to proceed with the takedown.
This requirement does not espouse that a complaining trade secret owner must disclose the details of the trade secret publicly in its takedown request because such disclosure would destroy the secret and cause the very harm the law is trying to avoid. Rather, consistent with already existing procedural practice in trade-secret-misappropriation *8 cases, no more than what is necessary to meet the pleading requirements of a complaint should be provided. [FN62] Thus, the takedown request should call for a description of the trade secret in a manner adequate to permit the ISP to recognize and identify the objectionable posting. The request should also identify the particular location of the material by, for instance, a link or Web address.

PROSPECTIVE APPLICATION OF THE TAKEDOWN MECHANISM

The Wal-Mart hypothetical presented at the beginning of this article would be different if this proposal were enacted. Upon discovering the content of the sales circular on fatwallet.com on Friday afternoon, Wal-Mart would immediately submit a statutorily compliant takedown request to the operators of the Web site, along with the required fee. [FN63] The material would be removed within five hours. Wal-Mart would obtain the identity of the poster via the subpoena provision and would initiate an action within 10 days of submitting the takedown or submit proof of an agreement with the poster. Otherwise, the material would be put back on the site. Thus, by Friday evening the information would be disabled. This is a far shorter period of time than the approximately seven days that may have elapsed under the current regime. [FN64]
Consider another example of a well-known company's trade secret being posted on the Internet. Assume that a disgruntled former Microsoft employee, Dave, who had access to the top-secret source code of a soon-to-be-released operating system, keeps the source code after leaving the company (in violation of his agreement) and decides to sell it on a Web site critical of Microsoft, microsoftsucks.com. [FN65] Dave posts it anonymously on the site and describes it as "jacked from Microsoft" and "not available anywhere else."
Microsoft discovers the posting immediately after it appears on the site and contacts the Web site to have it removed. The operators refuse to do so. Post enactment of a trade secret-takedown provision, that refusal would most likely be replaced by compliance because of the promise of immunity. Assume, however, that Dave, in defending himself in a misappropriation action, claims that the takedown provision is unconstitutional because it violates his rights under the First Amendment. The next part briefly addresses that argument. [FN66]

POTENTIAL CONCERNS

It is important to note that takedown legislation is only one piece of the puzzle in dealing with the larger problem of trade secrets on the Internet, and any real solutions must involve a multifaceted approach that includes technological and international considerations. On balance, the potential benefits of this legislation outweigh the drawbacks, and it is a necessary initial step toward a resolution of the problem. This part highlights two possible challenges to this kind of legislation.

FIRST AMENDMENT OBJECTIONS

One of the strongest potential challenges facing a scheme that causes an ex ante removal of information from the Internet, without a court having had the opportunity to issue a ruling, is the First Amendment. "[T]he First Amendment generally prohibits limitations, absent some extraordinary showing of governmental interest, on the publication of information already made public." [FN67] When weighing First Amendment rights against the commercial interest in protecting trade secrets, courts are often reluctant to enjoin disclosures of trade secrets. [FN68] While the kind of speech restriction proposed here presents thorny issues, they are not insurmountable or fatal to trade secret takedown legislation. Ultimately, in practical terms, the goal is to strike the proper balance between preventing disclosures motivated by vengeance and reprisal and permitting those that are more readily recognized as being in the public interest. [FN69]
It is beyond the scope of this article to enter the larger discussion about the role of the First Amendment in trade secret law. [FN70] Nevertheless, to the extent that an exposition of the kind undertaken in this article requires an underlying belief about the place of the First Amendment, my peg would be closer to the middle of the debate. As an onlooker into the intricate world of First Amendment jurisprudence and its esteemed yet divergent commentators, I argue that, with limited exceptions, the use or disclosure of another person's trade secrets, without the privilege to do so, ought not constitute protected expression under the First Amendment. [FN71] As a result, First Amendment rights may trump trade secret protections in some circumstances, but not in most.
To the extent that trade secret misappropriation often involves breaches of contract or breaches of confidence, the First Amendment would generally not be implicated. [FN72] When the person posting the information is under a duty or is otherwise bound by an agreement not to disclose the trade secret, courts are more likely to address the incident as a contractual issue, and such a posting would not present First Amendment concerns. [FN73] Thus, when an employee discloses his or her employer's trade secrets on the Internet, it is expected that the First Amendment would not sanction the conduct.
Nonetheless, when a contract did not bind an alleged misappropriator or the person posting the trade secret (a potentially relevant distinction on the Internet), the *9 potential for running afoul of the First Amendment may be greater. [FN74] Thus, as to company outsiders who themselves are not bound by any duty of confidentiality, First Amendment concerns may be implicated. [FN75] Accordingly, the First Amendment question is relevant here to the extent that trade secret takedown legislation would cover these persons. [FN76]
As long as the enacted regulation provides sufficient safeguards to ensure that complainants are owners of protectable trade secrets and there is recognition of certain exceptions to allow for expressions that are in the public interest, such as the health and safety exceptions already recognized by trade secret law, [FN77] takedown legislation should withstand First Amendment scrutiny. [FN78] Moreover, the fact that the DMCA has withstood First Amendment challenges [FN79] suggests that a trade secret takedown provision ought to fare at least as well.

TECHNOLOGICAL PUZZLES

Even with the best-laid legislation, technological advancement will continue to pose difficulties for trade secret owners seeking to enforce their rights over the Internet. This is part of a larger problem when emerging technologies test the existing legal paradigms and create the ever-changing potential for users, with either good or bad intentions, to thwart the law. [FN80]
Moreover, it would be remiss to overlook the cultural backlash that a trade secret takedown mechanism may engender, both generally and in specific cases. Indeed, there is always the risk that attempts to take down posted information may result in even-more rapid spreading of the information. [FN81] At the very least, like the DMCA, Web sites, or projects dedicated to collecting trade secret owners' takedown notices are certain to emerge, giving even-greater exposure to the alleged secrets.
One approach would be to let the courts deal with these issues as they arise. Indeed, some commentators suggest that legislation constrains the courts, which are better equipped to develop doctrine in a manner that is "fluid and responsive to changes in technology." [FN82] However, courts may often defer to policymakers to legislate these new challenges and simply find that certain technological advances are not contemplated in existing legislation. [FN83] As one court lamented:
It is not the province of the courts ... to rewrite the DMCA in order to make it fit a new and unforeseen internet architecture, no matter how damaging that development has been .... The plight of copyright holders must be addressed in the first instance by the Congress .... [FN84]
In the end, there is no uncomplicated answer, and the solution probably lies in a multifaceted approach with built-in flexibility.
Even with legislation, it will continue to be possible for creative and motivated individuals to evade compliance. For example, a practical problem and potential loophole that may continue to plague trade secret owners is the ease with which alleged misappropriators can simply move the material to a different site after being subject to a takedown. [FN85] In other instances, they may also repost the information on the same site by altering their identities. [FN86] Moreover, even without human manipulation, a cached version of the information may remain on the search engine or on the hard drive of anyone who has viewed the information. [FN87] Once a search engine picks the information, it may also store the information on its own server, which makes it possible for multiple servers to store the material. Finally, the information may also remain in archival form on the Internet. [FN88]
It is important to recognize that legislation alone may not be the best approach to this kind of problem, which in many ways seems ill suited to the fluid and individualized nature of trade secret law. Ironically, in time, trade secret owners may discover that technology proves the most successful way to combat other technology. [FN89] Imagine, for instance, a brave new world where Web crawlers search the Internet continuously for specially tagged trade secret information and prevent its transmission or posting on any unauthorized site. [FN90] Until then, however, it would be imprudent for trade secret owners to ignore the fact that the best defense is a good offense; vigilance in protecting [FN91] and monitoring trade secrets before they are posted on the Internet is critical. To that end, an assortment of technological tools is available to monitor employees and maintain better control of trade-secret information. [FN92]

CONCLUSION

For trade secret owners, the goal ought to be keeping their trade secrets from leaking onto the Internet in the first instance. When a trade secret is revealed on the Internet despite the owner's best efforts, however, as presented in the hypothetical at the beginning of this article, any chance of saving the trade secret from destruction lies in the trade secret owner's acting with utmost urgency to prevent further dissemination of the secret. Currently, the only available judicial instrument to effectuate removal of a trade secret posted on the Internet is injunctive relief. The speed with which information can be circulated over the Internet, coupled with the time and expense involved in seeking injunctive relief, suggests that a more expedient *10 and efficient mechanism is necessary to fill the gap until a court can intervene.
This article has explored the possibility of legislation, using the safe harbor provision of the DMCA as a starting point, that would offer a shield to trade-secret owners to protect their intellectual property while also providing a safe harbor to ISPs from trade secret misappropriation claims. From a trade secret owner's perspective, the ability to have trade secret information removed from a Web site via a takedown provision is undoubtedly valuable. Accordingly, given the importance of trade secrets to US businesses, Congress should enact takedown legislation for trade secrets.
[FNa1]. Elizabeth A. Rowe is an Associate Professor of Law at the University of Florida, Levin College of Law. This article is adapted from a full-length law review article that first appeared in the Wisconsin Law Review at 2007 Wis. L. Rev. 1041 (2007). It appears here with permission of the Wisconsin Law Review. I thank Alicia Phillip and Abbey Morrow for their research assistance in preparing this version of the article.

[FN3]. See generally Katherine V.W. Stone, "The New Psychological Contract: Implications of the Changing Workplace for Labor and Employment Law," 48 UCLA L. Rev. 519, 552 (2001) (discussing the old psychological contract, which required the employee to give loyalty to the employer in exchange for job security and indicating that it has been replaced with lower expectations from both the employee and the employer); Benjamin Aaron & Matthew Finkin, "The Law of Employee Loyalty in the United States," 20 Comp. Lab. L. & Pol'y J. 321, 339 (1999) (examining various components of employee loyalty).

[FN6]. See Ruckelshaus v. Monsanto Co., 467 U.S. 986, 1002 (1984) ( "Information that is public knowledge or that is generally known in an industry cannot be a trade secret."); Kewanee Oil Co. v. Bicron Corp., 416 U.S. 470, 475 (1974) ("The subject of a trade secret must be secret, and must not be of public knowledge or of a general knowledge in the trade or business."). For a more-detailed analysis of trade secrets on the Internet, see Elizabeth A. Rowe, "Saving Trade Secret Disclosures on the Internet Through Sequential Preservation," 42 Wake Forest L. Rev. 1, 7-10 (2007).

[FN8]. See, e.g., Jerome Stevens Pharms., Inc., 402 F.3d at 1254-1255, 1258 (reversing the district court's dismissal by holding that the FDA could be liable for misappropriation of trade secrets where it posted plaintiff's trade secrets on its Web site for five months and remanding the case to the district court).

[FN10]. See Rowe, supra n.7, at 29-39 (discussing a preservation model for analyzing when trade-secret protection may be retained despite disclosure).

[FN11]. Id. at 32-33.

[FN12]. The appropriate strategy must be carefully tailored in light of the circumstances. See Victoria A. Cundiff, "Trade Secrets and the Internet: Preventing the Internet from Being an Instrument of Destruction," in 12th Annual Institute on Intellectual Property Law 403, 408-413 (PLI Intellectual Property, Course Handbook Series No. G-877, 2006). (discussing considerations in litigating to remove trade secrets from the Internet).

[FN18]. While the risk of loss is one that is inherent in choosing this form of protection, it does not necessarily suggest that a trade secret owner should have instead chosen patent protection. The choice of trade-secret protection or patent protection must be based on a very careful assessment of the particular information involved and thorough consideration of business and legal factors involving, for example, the nature of the information, the ease with which it can be reverse engineered, and the feasibility and cost of obtaining patent protection. See generally Andrew Beckerman-Rodau, "The Choice Between Patent Protection and Trade Secret Protection: A Legal Business Decision," 84 J. Pat. & Trademark Off. Soc'y 371 (2002). Accordingly, an owner that chooses trade secret protection over patent protection has not necessarily forgone a "better" form of protection, especially since there is a wide range of information that is eligible for trade secret protection but not patent protection. See generally James Pooley, Trade Secrets § 3.01[1][a] (1997), (comparing patent protection and trade secret protection).

[FN19]. Some commentators question whether ISPs should ever be liable for copyright infringement. See, e.g., Marjorie Heins & Tricia Beckles, Brennan Center for Justice, Will Fair Use Survive? 5 (2005). This debate is beyond the scope of this article.

[FN39]. Under the DMCA, if an owner misrepresented its claim in the takedown notice, then the owner is liable to the ISP for any damages resulting from an improper removal of material. 17 U.S.C. § 512(f) (2000).

[FN40]. Id. Under § 512(f) any of the parties involved may be awarded damages, costs, and attorneys' fees if either the copyright owner or the alleged infringer makes a knowing, material misrepresentation in a notice or countemotice. Id.

[FN44]. See, e.g., id. (ruling in the context of an antitrust claim that "the assertion of a trade secret claim in bad faith, in an attempt to monopolize, can be a violation of the antitrust laws.") (Internal citations omitted).

[FN45]. Congress, in § 512(a), codified the decision in Religious Technology Center v. Netcom, 17 U.S.C. § 512(a) (2000); Religious Tech. Ctr. v. Netcom On-Line Commc'ns Servs., Inc., 907 F. Supp. 1361, 1372 (N.D. Cal. 1995) ("It would be especially inappropriate to hold liable a service that acts more like a conduit, in other words, one that does not itself keep an archive of files for more than a short duration."). It thus preserves immunity for ISPs that do no more than move packets of information on the Internet. See H.R. Rep. No. 105-796, at 19-20 (1998) (Conf. Rep.).

[FN47]. To the extent that there is concern about the possibility of liability, a blanket safe harbor or exemption from liability for these providers may be advisable.

[FN48]. This phrase is meant to capture traditional news organizations, such as television stations, newspapers, and magazines, that have editorial staff that review and make decisions about publication. The phrase excludes bloggers, Web site operators, and all nontraditional newspersons.

[FN49]. See Bartnicki v. Vopper, 532 U.S. 514, 525 (2001).

[FN50]. See Shoen v. Shoen, 5 F.3d 1289, 1293 (9th Cir. 1993) (recommending a focus on whether there was intent to disseminate the information to the public at the beginning of the newsgathering process).

[FN51]. Restatement (Third) of Unfair Competition § 40 cmt. c (1995).

[FN52]. A key first step in filing suit against an alleged misappropriator is to obtain the identity of the individual. Cundiff, supra n.13, at 409.

[FN53]. See 17 U.S.C. § 512(h) (2000). The subpoena is granted on the condition that the identity will be used only in relation to the protection of the intellectual-property rights of the copyright owner. Id. § 512(h)(2)(C).

[FN54]. See Recording Indus. Ass'n of Am., Inc. v. Verizon Internet Servs., Inc., 351 F.3d 1229, 1233 (D.C. Cir. 2003) ("We conclude from both the terms of § 512(h) and the overall structure of § 512 that ... a subpoena may be issued only to an ISP engaged in storing on its servers material that is infringing or the subject of infringing activity.").

[FN55]. One potential problem with obtaining subpoenas based on the Internet Protocol (IP) address of a computer is that the owner of the computer may not necessarily have been the alleged misappropriator. Someone else could have used the computer. See, e.g., Emily Umbright, "DMCA Proof Internet Law Still Evolving," St. Louis Daily Rec., Aug. 29, 2003 (discussing the music industry's subpoenas to alleged copyright infringers).

[FN62]. A plaintiff must generally plead (1) ownership of a trade secret, (2) misappropriation by the defendant, and (3) harm. See Pooley, supra n.20, § 10.07[1]. Detailed descriptions of the trade secret are generally filed under seal and are subject to a protective order later in the litigation. See id.; Fed. R. Civ. P. 26(b)(5) (allowing parties to describe the nature of information that is privileged without having to disclose or produce the privileged information itself).

[FN63]. It may also be wise to submit a takedown to the search engines, which may have already captured the information.

[FN64]. Wal-Mart may still have to contend with the fact that some people may have already accessed the information during the time that it was available. This is the kind of weakness that is inevitable when trade secrets appear on the Internet. However, the question of whether Wal-Mart may be able to enjoin its competitors from using the information is a separate issue that will necessitate a careful consideration of several factors, such as whether the information retained trade secret protection despite having appeared on the Web site for a few hours and whether the competitor knew it was a trade secret when it came upon the information. See Rowe, supra n.7, at 29-37 (discussing a model for analyzing this kind of inquiry). Nonetheless, as part of the analysis, Wal-Mart's argument for retaining trade secret protection will be strengthened by its having used the takedown provision instead of waiting about a week or more, at which point the information would, in all likelihood, be deemed generally known and thus unprotectable.

[FN65]. This hypothetical is loosely based on United States v. Genovese, 409 F. Supp. 2d 253, 254-255 (S.D.N.Y. 2005).

[FN66]. For a more detailed analysis of the First Amendment argument, see Rowe, supra n.1, at 1071-1084.

[FN68]. See Procter & Gamble Co. v. Bankers Trust Co., 78 F.3d 219, 225 (6th Cir. 1996) (refusing to enjoin publication of trade secrets improperly obtained in violation of a protective order and noting that "[t]he private litigants' interest in protecting their vanity or their commercial self-interest simply does not qualify as grounds for imposing a prior restraint").

[FN69]. For instance, a person may be privileged to disclose trade secret information "that is relevant to public health or safety, or to the commission of a crime or tort, or to other matters of substantial public concern." Restatement (Third) of Unfair Competition § 40 cmt. c (1995). Some whistleblowing statutes also privilege disclosures of trade secrets. See, e.g., 5 U.S.C. § 2302(b)(8) (2000); N.Y. Lab. Law § 740 (McKinney 2002 & Supp. 2007).

[FN74]. See Ford Motor Co. v. Lane, 67 F. Supp. 2d 745 (E.D. Mich. 1999). The defendant operated a Web site with news about Ford and its products. Lane received confidential Ford documents from an anonymous source and initially agreed not to disclose most of the information. However, Lane eventually published some documents relating to the quality of Ford's products on his Web site because he believed that the public had a right to know. He did so despite knowing that the documents were confidential. Ford sought a restraining order to prevent publication of the documents, claiming the documents were trade secrets. The court acknowledged, without any discussion, that Ford could show Lane had misappropriated its trade secrets, but the court reversed the order on First Amendment grounds, concluding that considering an injunction to prevent Lane from publishing trade secrets was a prior restraint. Id. at 747-750.

[FN75]. The First Amendment may not protect a person who tries to convert a trade secret for economic gain. See United States v. Genovese, 409 F. Supp. 2d 253, 256 (S.D.N.Y. 2005).

[FN76]. One interesting side note is whether ISPs would have a recognized First Amendment right to assist in the disclosure of a trade secret. As a practical matter, the issue will likely be moot. Since compliance with a takedown provision would provide safe harbor to ISPs, they are unlikely to raise the issue. Beyond that, however, they are at least one step removed from the disclosure--mere vessels or a medium to transmit the information--thus, assertion of a right to speak appears attenuated. They are therefore neither like the individual posting the trade secret nor like the press in the First Amendment analysis.

[FN78]. Cf. In re Verizon Internet Servs., Inc., 257 F. Supp. 2d 244, 258-264 (D.D.C. 2003) ("[T]here is some level of First Amendment protection that should be afforded to anonymous expression on the Internet, even though the degree of protection is minimal where alleged copyright infringement is the expression at issue."), rev'd on other grounds, 351 F.3d 1229, 1233 (D.C. Cir. 2003) (finding that the DMCA provided sufficient safeguards).

[FN79]. See, e.g., id.; Universal City Studios, Inc. v. Corley, 273 F.3d 429, 454-455 (2d Cir. 2001) (upholding an injunction under the anticircumvention provision and finding that the government has a substantial interest in preventing unauthorized access to encrypted copyrighted material). More generally, the Supreme Court has made clear that the First Amendment does not protect speech that infringes copyright. See Harper & Row, Publishers, Inc. v. Nation Enters., 471 U.S. 539, 555-560 (1985).

[FN80]. See generally Tomas A. Lipinski, "The Developing Legal Infrastructure and the Globalization of Information: Constructing a Framework for Critical Choices in the New Millennium Internet--Character, Content and Confusion," 6 Rich. J.L. & Tech., 19, ¶¶ 22, 30 (Winter 1999-2000), http:// www.richmond.edu/jolt/v6i4article2.html (discussing how copyright law and trademark law have had to adapt to new technologies); Richard H. Chused, "Rewrite Copyright: Protecting Creativity and Social Utility in the Digital Age," Israel L. Rev., Fall 2005, at 80, 83 (discussing responses to new technological developments).

[FN89]. For instance, movie studios, frustrated by hackers discovering and posting passwords on the Internet to enable copying of DVDs, have a new strategy. If hackers post stolen passwords on the Web, the studios can change the passwords, disabling the ability to play the DVD unless the consumer downloads updated software with the new password. Keith Winstein, "Consumers May Get Caught in Piracy War--Strategy To Thwart Movie Copying Could Frustrate Innocent Users," Wall St. J., July 5, 2007, at B3.